Security and roles based authority in a smart client

I have started looking for a new way to track permissions in a smart client for a SaaS-based rich client. So far, I have nothing but theory. As I develop code, I will post. The problem I see is this; current application structures rely completely on the server or a cached principal of the server to allow operations. Offline or disconnected modes become limited.